源碼分析shiro認證受權流程

時間 2019-11-05

標籤源碼分析 shiro 認證受權流程简体版

原文原文鏈接

1. shiro介紹html

Apache Shiro是一個強大易用的Java安全框架，提供了認證、受權、加密和會話管理等功能： java

認證 - 用戶身份識別，常被稱爲用戶「登陸」；
受權 - 訪問控制；
密碼加密 - 保護或隱藏數據防止被偷窺；
會話管理 - 每用戶相關的時間敏感的狀態。

對於任何一個應用程序，Shiro均可以提供全面的安全管理服務。而且相對於其餘安全框架，Shiro要簡單的多。sql

2. shiro源碼概況數據庫

先要了解shiro的基本框架(見http://www.cnblogs.com/davidwang456/p/4425145.html)。apache

而後看一下各個組件之間的關係：編程

一下內容參考：http://kdboy.iteye.com/blog/1154644緩存

Subject：即「當前操做用戶」。可是，在Shiro中，Subject這一律念並不只僅指人，也能夠是第三方進程、後臺賬戶（Daemon Account）或其餘相似事物。它僅僅意味着「當前跟軟件交互的東西」。但考慮到大多數目的和用途，你能夠把它認爲是Shiro的「用戶」概念。
Subject表明了當前用戶的安全操做，SecurityManager則管理全部用戶的安全操做。

SecurityManager：它是Shiro框架的核心，典型的Facade模式，Shiro經過SecurityManager來管理內部組件實例，並經過它來提供安全管理的各類服務。

Realm： Realm充當了Shiro與應用安全數據間的「橋樑」或者「鏈接器」。也就是說，當對用戶執行認證（登陸）和受權（訪問控制）驗證時，Shiro會從應用配置的Realm中查找用戶及其權限信息。
從這個意義上講，Realm實質上是一個安全相關的DAO：它封裝了數據源的鏈接細節，並在須要時將相關數據提供給Shiro。當配置Shiro時，你必須至少指定一個Realm，用於認證和（或）受權。配置多個Realm是能夠的，可是至少須要一個。
Shiro內置了能夠鏈接大量安全數據源（又名目錄）的Realm，如LDAP、關係數據庫（JDBC）、相似INI的文本配置資源以及屬性文件等。若是缺省的Realm不能知足需求，你還能夠插入表明自定義數據源的本身的Realm實現。安全

Shiro主要組件還包括：
Authenticator ：認證就是覈實用戶身份的過程。這個過程的常見例子是你們都熟悉的「用戶/密碼」組合。多數用戶在登陸軟件系統時，一般提供本身的用戶名（當事人）和支持他們的密碼（證書）。若是存儲在系統中的密碼（或密碼錶示）與用戶提供的匹配，他們就被認爲經過認證。
Authorizer ：受權實質上就是訪問控制 - 控制用戶可以訪問應用中的哪些內容，好比資源、Web頁面等等。
SessionManager ：在安全框架領域，Apache Shiro提供了一些獨特的東西：可在任何應用或架構層一致地使用Session API。即，Shiro爲任何應用提供了一個會話編程範式 - 從小型後臺獨立應用到大型集羣Web應用。這意味着，那些但願使用會話的應用開發者，沒必要被迫使用Servlet或EJB容器了。或者，若是正在使用這些容器，開發者如今也能夠選擇使用在任何層統一一致的會話API，取代Servlet或EJB機制。
CacheManager :對Shiro的其餘組件提供緩存支持。 session

3. 作一個demo，跑shiro的源碼，從login開始：架構

第一步：用戶根據表單信息填寫用戶名和密碼，而後調用登錄按鈕。內部執行以下：

    UsernamePasswordToken token = new UsernamePasswordToken(loginForm.getUsername(), loginForm.getPassphrase());

    token.setRememberMe(true);

    Subject currentUser = SecurityUtils.getSubject();

    currentUser.login(token);

第二步：代理DelegatingSubject繼承Subject執行login

 public void login(AuthenticationToken token) throws AuthenticationException {
        clearRunAsIdentitiesInternal();
        Subject subject = securityManager.login(this, token);

        PrincipalCollection principals;

        String host = null;

        if (subject instanceof DelegatingSubject) {
            DelegatingSubject delegating = (DelegatingSubject) subject;
            //we have to do this in case there are assumed identities - we don't want to lose the 'real' principals:
            principals = delegating.principals;
            host = delegating.host;
        } else {
            principals = subject.getPrincipals();
        }

        if (principals == null || principals.isEmpty()) {
            String msg = "Principals returned from securityManager.login( token ) returned a null or " +
                    "empty value.  This value must be non null and populated with one or more elements.";
            throw new IllegalStateException(msg);
        }
        this.principals = principals;
        this.authenticated = true;
        if (token instanceof HostAuthenticationToken) {
            host = ((HostAuthenticationToken) token).getHost();
        }
        if (host != null) {
            this.host = host;
        }
        Session session = subject.getSession(false);
        if (session != null) {
            this.session = decorate(session);
        } else {
            this.session = null;
        }
    }

第三步：調用DefaultSecurityManager繼承SessionsSecurityManager執行login方法

    public Subject login(Subject subject, AuthenticationToken token) throws AuthenticationException {
        AuthenticationInfo info;
        try {
            info = authenticate(token);
        } catch (AuthenticationException ae) {
            try {
                onFailedLogin(token, ae, subject);
            } catch (Exception e) {
                if (log.isInfoEnabled()) {
                    log.info("onFailedLogin method threw an " +
                            "exception.  Logging and propagating original AuthenticationException.", e);
                }
            }
            throw ae; //propagate
        }

       Subject loggedIn = createSubject(token, info, subject);

        onSuccessfulLogin(token, info, loggedIn); return loggedIn;
    }

第四步：認證管理器AuthenticatingSecurityManager繼承RealmSecurityManager執行authenticate方法：

    /**
     * Delegates to the wrapped {@link org.apache.shiro.authc.Authenticator Authenticator} for authentication.
     */
    public AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {
        return this.authenticator.authenticate(token);
    }

第五步：抽象認證管理器AbstractAuthenticator繼承Authenticator, LogoutAware 執行authenticate方法：

public final AuthenticationInfo authenticate(AuthenticationToken token) throws AuthenticationException {

        if (token == null) {
            throw new IllegalArgumentException("Method argumet (authentication token) cannot be null.");
        }

        log.trace("Authentication attempt received for token [{}]", token);

        AuthenticationInfo info;
        try {
            info = doAuthenticate(token);
            if (info == null) {
                String msg = "No account information found for authentication token [" + token + "] by this " +
                        "Authenticator instance.  Please check that it is configured correctly.";
                throw new AuthenticationException(msg);
            }
        } catch (Throwable t) {
            AuthenticationException ae = null;
            if (t instanceof AuthenticationException) {
                ae = (AuthenticationException) t;
            }
            if (ae == null) {
                //Exception thrown was not an expected AuthenticationException.  Therefore it is probably a little more
                //severe or unexpected.  So, wrap in an AuthenticationException, log to warn, and propagate:
                String msg = "Authentication failed for token submission [" + token + "].  Possible unexpected " +
                        "error? (Typical or expected login exceptions should extend from AuthenticationException).";
                ae = new AuthenticationException(msg, t);
            }
            try {
                notifyFailure(token, ae);
            } catch (Throwable t2) {
                if (log.isWarnEnabled()) {
                    String msg = "Unable to send notification for failed authentication attempt - listener error?.  " +
                            "Please check your AuthenticationListener implementation(s).  Logging sending exception " +
                            "and propagating original AuthenticationException instead...";
                    log.warn(msg, t2);
                }
            }


            throw ae;
        }

        log.debug("Authentication successful for token [{}].  Returned account [{}]", token, info);

        notifySuccess(token, info);

        return info;
    }

第六步：ModularRealmAuthenticator繼承AbstractAuthenticator執行doAuthenticate方法

    protected AuthenticationInfo doAuthenticate(AuthenticationToken authenticationToken) throws AuthenticationException {
        assertRealmsConfigured();
        Collection<Realm> realms = getRealms();
        if (realms.size() == 1) {
            return doSingleRealmAuthentication(realms.iterator().next(), authenticationToken);
        } else {
            return doMultiRealmAuthentication(realms, authenticationToken);
        }
    }

接着調用：

    /**
     * Performs the authentication attempt by interacting with the single configured realm, which is significantly
     * simpler than performing multi-realm logic.
     *
     * @param realm the realm to consult for AuthenticationInfo.
     * @param token the submitted AuthenticationToken representing the subject's (user's) log-in principals and credentials.
     * @return the AuthenticationInfo associated with the user account corresponding to the specified {@code token}
     */
    protected AuthenticationInfo doSingleRealmAuthentication(Realm realm, AuthenticationToken token) {
        if (!realm.supports(token)) {
            String msg = "Realm [" + realm + "] does not support authentication token [" +
                    token + "].  Please ensure that the appropriate Realm implementation is " +
                    "configured correctly or that the realm accepts AuthenticationTokens of this type.";
            throw new UnsupportedTokenException(msg);
        }
        AuthenticationInfo info = realm.getAuthenticationInfo(token);
        if (info == null) {
            String msg = "Realm [" + realm + "] was unable to find account data for the " +
                    "submitted AuthenticationToken [" + token + "].";
            throw new UnknownAccountException(msg);
        }
        return info;
    }

第七步：AuthenticatingRealm繼承CachingRealm執行getAuthenticationInfo方法

   public final AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        AuthenticationInfo info = getCachedAuthenticationInfo(token); //從緩存中讀取
        if (info == null) {
            //otherwise not cached, perform the lookup:
            info = doGetAuthenticationInfo(token); //緩存中讀不到，則到數據庫或者ldap或者jndi等去讀
            log.debug("Looked up AuthenticationInfo [{}] from doGetAuthenticationInfo", info);
            if (token != null && info != null) {
                cacheAuthenticationInfoIfPossible(token, info);
            }
        } else {
            log.debug("Using cached authentication info [{}] to perform credentials matching.", info);
        }

        if (info != null) {
            assertCredentialsMatch(token, info);
        } else {
            log.debug("No AuthenticationInfo found for submitted AuthenticationToken [{}].  Returning null.", token);
        }

        return info;
    }

1. 從緩存中讀取的方法：

    /**
     * Checks to see if the authenticationCache class attribute is null, and if so, attempts to acquire one from
     * any configured {@link #getCacheManager() cacheManager}.  If one is acquired, it is set as the class attribute.
     * The class attribute is then returned.
     *
     * @return an available cache instance to be used for authentication caching or {@code null} if one is not available.
     * @since 1.2
     */
    private Cache<Object, AuthenticationInfo> getAuthenticationCacheLazy() {

        if (this.authenticationCache == null) {

            log.trace("No authenticationCache instance set.  Checking for a cacheManager...");

            CacheManager cacheManager = getCacheManager();

            if (cacheManager != null) {
                String cacheName = getAuthenticationCacheName();
                log.debug("CacheManager [{}] configured.  Building authentication cache '{}'", cacheManager, cacheName);
                this.authenticationCache = cacheManager.getCache(cacheName);
            }
        }

        return this.authenticationCache;
    }

2. 從數據庫中讀取的方法：

JdbcRealm繼承 AuthorizingRealm執行doGetAuthenticationInfo方法

 protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        UsernamePasswordToken upToken = (UsernamePasswordToken) token;
        String username = upToken.getUsername();

        // Null username is invalid
        if (username == null) {
            throw new AccountException("Null usernames are not allowed by this realm.");
        }

        Connection conn = null;
        SimpleAuthenticationInfo info = null;
        try {
            conn = dataSource.getConnection();

            String password = null;
            String salt = null;
            switch (saltStyle) {
            case NO_SALT:
                password = getPasswordForUser(conn, username)[0];
                break;
            case CRYPT:
                // TODO: separate password and hash from getPasswordForUser[0]
                throw new ConfigurationException("Not implemented yet");
                //break;
            case COLUMN:
                String[] queryResults = getPasswordForUser(conn, username);
                password = queryResults[0];
                salt = queryResults[1];
                break;
            case EXTERNAL:
                password = getPasswordForUser(conn, username)[0];
                salt = getSaltForUser(username);
            }

            if (password == null) {
                throw new UnknownAccountException("No account found for user [" + username + "]");
            }

            info = new SimpleAuthenticationInfo(username, password.toCharArray(), getName());
            
            if (salt != null) {
                info.setCredentialsSalt(ByteSource.Util.bytes(salt));
            }

        } catch (SQLException e) {
            final String message = "There was a SQL error while authenticating user [" + username + "]";
            if (log.isErrorEnabled()) {
                log.error(message, e);
            }

            // Rethrow any SQL errors as an authentication exception
            throw new AuthenticationException(message, e);
        } finally {
            JdbcUtils.closeConnection(conn);
        }

        return info;
    }

接着調用sql語句：

 private String[] getPasswordForUser(Connection conn, String username) throws SQLException {

        String[] result;
        boolean returningSeparatedSalt = false;
        switch (saltStyle) {
        case NO_SALT:
        case CRYPT:
        case EXTERNAL:
            result = new String[1];
            break;
        default:
            result = new String[2];
            returningSeparatedSalt = true;
        }
        
        PreparedStatement ps = null;
        ResultSet rs = null;
        try {
            ps = conn.prepareStatement(authenticationQuery);
            ps.setString(1, username);

            // Execute query
            rs = ps.executeQuery();

            // Loop over results - although we are only expecting one result, since usernames should be unique
            boolean foundResult = false;
            while (rs.next()) {

                // Check to ensure only one row is processed
                if (foundResult) {
                    throw new AuthenticationException("More than one user row found for user [" + username + "]. Usernames must be unique.");
                }

                result[0] = rs.getString(1);
                if (returningSeparatedSalt) {
                    result[1] = rs.getString(2);
                }

                foundResult = true;
            }
        } finally {
            JdbcUtils.closeResultSet(rs);
            JdbcUtils.closeStatement(ps);
        }

        return result;
    }

其中authenticationQuery定義以下：

 protected String authenticationQuery = DEFAULT_AUTHENTICATION_QUERY;
 protected static final String DEFAULT_AUTHENTICATION_QUERY = "select password from users where username = ?";

4. 小結

Apache Shiro 是功能強大而且容易集成的開源權限框架，它可以完成認證、受權、加密、會話管理等功能。認證和受權爲權限控制的核心，簡單來講，「認證」就是證實你是誰？ Web 應用程序通常作法經過表單提交用戶名及密碼達到認證目的。「受權」便是否容許已認證用戶訪問受保護資源。

參考文獻：

http://kdboy.iteye.com/blog/1154644

http://www.ibm.com/developerworks/cn/java/j-lo-shiro/